webhook

package
v1.8.9 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 17, 2026 License: Apache-2.0 Imports: 43 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var ErrHMACVerificationFailed = errors.New("HMAC verification failed")

ErrHMACVerificationFailed is returned when a registry webhook signature check fails.

Functions

func GetAPIURLRegex added in v1.8.8

func GetAPIURLRegex(apiURL string) (*regexp.Regexp, error)

GetAPIURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given apiURL.

func GetWebURLRegex added in v1.8.8

func GetWebURLRegex(webURL string) (*regexp.Regexp, error)

GetWebURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given webURL. webURL is expected to be a URL from an SCM webhook payload pointing to the web page for the repo.

func ParseRevision added in v1.8.8

func ParseRevision(ref string) string

Types

type Extractor added in v1.8.8

type Extractor interface {
	CanHandle(r *http.Request) bool
	Parse(r *http.Request) (any, error)
}

Extractor dispatches a webhook request to the matching provider.

CanHandle inspects request headers to decide whether this parser owns the request. Parse extracts the provider-specific payload. On verification failures it either emits a security-audit log line directly or returns a known sentinel error (e.g. ErrHMACVerificationFailed) that the caller logs centrally. A (nil, nil) return signals a request that was claimed but intentionally skipped (e.g. an unsupported sub-event).

type GHCRPayload added in v1.8.8

type GHCRPayload struct {
	Action  string `json:"action"`
	Package struct {
		Name        string `json:"name"`
		PackageType string `json:"package_type"`
		Owner       struct {
			Login string `json:"login"`
		} `json:"owner"`
		PackageVersion struct {
			ContainerMetadata struct {
				Tag struct {
					Name string `json:"name"`
				} `json:"tag"`
			} `json:"container_metadata"`
		} `json:"package_version"`
	} `json:"package"`
}

GHCRPayload represents the webhook payload sent by GitHub for package events.

type Handler added in v1.8.8

type Handler struct {
	sync.WaitGroup // for testing
	// contains filtered or unexported fields
}

func NewHandler

func NewHandler(namespace string, applicationNamespaces []string, webhookParallelism int, webhookRefreshWorkers int, appClientset appclientset.Interface, appsLister alpha1.ApplicationLister, set *settings.Settings, settingsSrc settingsSource, repoCache *cache.Cache, serverCache *servercache.Cache, appDB db.DB, maxWebhookPayloadSizeB int64, webhookRefreshJitter time.Duration, webhookRefreshJitterThreshold int) *Handler

func (*Handler) HandleEvent added in v1.8.8

func (a *Handler) HandleEvent(payload any)

HandleEvent handles webhook events for repo push events

func (*Handler) HandleRegistryEvent added in v1.8.8

func (a *Handler) HandleRegistryEvent(event *RegistryEvent)

HandleRegistryEvent processes a normalized registry event and refreshes matching Hanzo CD Applications.

It constructs the full OCI repository URL from the event, finds Applications whose sources reference that repository and revision, and triggers a refresh for each matching Application. Namespace filters are applied according to the handler configuration.

func (*Handler) Handler added in v1.8.8

func (a *Handler) Handler(w http.ResponseWriter, r *http.Request)

func (*Handler) Shutdown added in v1.8.8

func (a *Handler) Shutdown()

Shutdown gracefully shuts down the webhook handler by closing queues and waiting for workers

type RegistryEvent added in v1.8.8

type RegistryEvent struct {
	// RegistryURL is the hostname of the registry, without protocol or trailing slash.
	// e.g. "ghcr.io", "docker.io", "123456789.dkr.ecr.us-east-1.amazonaws.com"
	// Together with Repository, it forms the OCI repo URL: oci://RegistryURL/Repository.
	// Parsers must ensure this value is consistent with how users configure repoURL
	// in their Hanzo CD Applications (e.g. oci://ghcr.io/owner/repo).
	RegistryURL string `json:"registryUrl,omitempty"`
	// Repository is the full repository path within the registry, without a leading slash.
	// e.g. "owner/repo" for ghcr.io, "library/nginx" for docker.io.
	// Together with RegistryURL, it forms the OCI repo URL: oci://RegistryURL/Repository.
	Repository string `json:"repository,omitempty"`
	// Tag is the image tag
	// eg. 0.3.0
	Tag string `json:"tag,omitempty"`
}

RegistryEvent represents a normalized container registry webhook event.

It captures the essential information needed to identify an OCI artifact update, including the registry host, repository name, tag, and optional content digest. This structure is produced by registry-specific parsers and consumed by the registry webhook handler to trigger application refreshes.

func (*RegistryEvent) OCIRepoURL added in v1.8.8

func (e *RegistryEvent) OCIRepoURL() string

OCIRepoURL returns the full OCI repository URL for use in Hanzo CD Application source matching, e.g. "oci://ghcr.io/owner/repo".

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL